---
title: "#apt37 articles | Hashnode"
description: "Explore 3 articles tagged #apt37 on Hashnode. Tutorials, guides, and how-tos from the community."
url: "https://hashnode.com/tag/apt37"
---

Tag

# #apt37

3 posts · 0 followers

[Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Apr 11](https://hashnode.com/posts/dprk-attack-campaign-abusing-lnk-files-and-github-c2-targeting-south-korea/69d9a577c8e5007ddb28c925)

### [DPRK Attack Campaign: Abusing LNK Files and GitHub C2 Targeting South Korea](https://blog.fiscybersec.com/dprk-attack-campaign-abusing-lnk-files-and-github-c2-targeting-south-korea?utm_source=hashnode&utm_medium=feed)

1\. Executive Summary In early April 2026, FortiGuard Labs disclosed an attack campaign linked to the Democratic People's Republic of Korea (DPRK), primarily targeting organizations in South Korea. Thi

19 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/dprk-attack-campaign-abusing-lnk-files-and-github-c2-targeting-south-korea?utm_source=hashnode&utm_medium=feed)

[DeepSeaX](https://hashnode.com/@deepseax) · [Feb 27](https://hashnode.com/posts/scarcruft-ruby-jumper-how-north-korean-hackers-breach-air-gapped-networks-via-usb-and-zoho-workdrive-in-2026/69a1a55212ef924a7bf83806)

### [ScarCruft Ruby Jumper: How North Korean Hackers Breach Air-Gapped Networks via USB and Zoho WorkDrive in 2026](https://deepseax.hashnode.dev/scarcruft-ruby-jumper-how-north-korean-hackers-breach-air-gapped-networks-via-usb-and-zoho-workdrive-in-2026?utm_source=hashnode&utm_medium=feed)

North Korea's ScarCruft (APT37) just raised the bar for air-gapped network attacks. Their new Ruby Jumper campaign, discovered by Zscaler ThreatLabz in December 2025, deploys six custom malware families — including a backdoor that abuses Zoho WorkDri...

5 min read · [deepseax.hashnode.dev](https://deepseax.hashnode.dev/scarcruft-ruby-jumper-how-north-korean-hackers-breach-air-gapped-networks-via-usb-and-zoho-workdrive-in-2026?utm_source=hashnode&utm_medium=feed)